From 6b003e089035d2b45eb3b91166b69dba8b51ffce Mon Sep 17 00:00:00 2001 From: Mohamed Ragab Date: Thu, 13 Aug 2026 17:28:43 +0300 Subject: [PATCH 1/3] Stop /paymob-test-cards promising kiosk credentials test-credentials.md documents cards and wallets only. The command's description advertised kiosk credentials that do not exist, and the kiosk branch implied the data was merely missing rather than absent by design. Generalize the branch to cover every uncovered method (kiosk, BNPL, Apple/Google Pay, installments) and bar substituting a card number or asserting an undocumented sandbox flow. --- commands/paymob-test-cards.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/commands/paymob-test-cards.md b/commands/paymob-test-cards.md index e220d49..d90775c 100644 --- a/commands/paymob-test-cards.md +++ b/commands/paymob-test-cards.md @@ -1,5 +1,5 @@ --- -description: Show Paymob sandbox test cards, wallet, and kiosk credentials, optionally filtered by payment method. +description: Show Paymob sandbox test card and wallet credentials, optionally filtered by payment method. argument-hint: "[card|wallet|kiosk]" allowed-tools: Read --- @@ -9,7 +9,7 @@ Read `${CLAUDE_PLUGIN_ROOT}/skills/paymob-integration/references/test-credential Argument handling for `$ARGUMENTS`: - `card` → show only the Mastercard and Visa test card sections. - `wallet` → show only the test mobile wallet section. -- `kiosk` → this reference file does not currently list kiosk sandbox credentials. Say so explicitly, then point the user to `references/live-resources.md` (the `llms.txt` doc index and developer docs) or `support@paymob.com` to get current kiosk sandbox details — do not invent kiosk numbers. +- `kiosk`, or any other method the file has no section for (BNPL, Apple/Google Pay, bank installments) → say plainly that this reference file lists credentials for cards and wallets only, and that it has no entry for the requested method. Then point the user to `references/live-resources.md` (the `llms.txt` doc index and developer docs) or `support@paymob.com` for that method's sandbox details. **Do not invent numbers, and do not substitute a card number as a stand-in.** Do not assert how the method's sandbox flow works either — if it isn't in the reference file, it isn't established here. - No argument → show all sections the file contains (cards and wallet). Always carry over, verbatim in meaning, these two caveats from the source file regardless of which filter was used: From cda7f378f471f221003d762b554d9b001d91534f Mon Sep 17 00:00:00 2001 From: Mohamed Ragab Date: Thu, 13 Aug 2026 17:46:00 +0300 Subject: [PATCH 2/3] Document that kiosk has no sandbox test path Paymob confirmed sandbox does not support kiosk transactions at all, so no kiosk test credentials exist and a kiosk payment cannot be completed end-to-end in Test mode. Record that in test-credentials.md with the consequence that matters: a green sandbox run does not cover kiosk, and substituting a test card exercises the card rail instead. The command now reports what that section says rather than carrying its own copy of the fact, so the reference file stays the single source. --- commands/paymob-test-cards.md | 3 ++- skills/paymob-integration/references/test-credentials.md | 9 +++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/commands/paymob-test-cards.md b/commands/paymob-test-cards.md index d90775c..81c8563 100644 --- a/commands/paymob-test-cards.md +++ b/commands/paymob-test-cards.md @@ -9,7 +9,8 @@ Read `${CLAUDE_PLUGIN_ROOT}/skills/paymob-integration/references/test-credential Argument handling for `$ARGUMENTS`: - `card` → show only the Mastercard and Visa test card sections. - `wallet` → show only the test mobile wallet section. -- `kiosk`, or any other method the file has no section for (BNPL, Apple/Google Pay, bank installments) → say plainly that this reference file lists credentials for cards and wallets only, and that it has no entry for the requested method. Then point the user to `references/live-resources.md` (the `llms.txt` doc index and developer docs) or `support@paymob.com` for that method's sandbox details. **Do not invent numbers, and do not substitute a card number as a stand-in.** Do not assert how the method's sandbox flow works either — if it isn't in the reference file, it isn't established here. +- `kiosk` → report what the file's **Methods with no sandbox test path** section says. Do not offer a workaround that section doesn't list, and do not substitute a test card so the method looks covered. +- Any other method the file has no section for (BNPL, Apple/Google Pay, bank installments) → say plainly that the file has no entry for it, then point the user to `references/live-resources.md` (the `llms.txt` doc index and developer docs) or `support@paymob.com`. **Do not invent numbers, and do not substitute a card number as a stand-in.** Do not assert how that method's sandbox flow works either — if it isn't in the reference file, it isn't established here. - No argument → show all sections the file contains (cards and wallet). Always carry over, verbatim in meaning, these two caveats from the source file regardless of which filter was used: diff --git a/skills/paymob-integration/references/test-credentials.md b/skills/paymob-integration/references/test-credentials.md index a1e21fb..244ed56 100644 --- a/skills/paymob-integration/references/test-credentials.md +++ b/skills/paymob-integration/references/test-credentials.md @@ -36,6 +36,15 @@ Use these **only** with Test-mode keys and Test-mode Integration IDs. Never use - MPIN code: `123456` - OTP: `123456` +## Methods with no sandbox test path + +⚠️ **Kiosk (Aman, Masary) cannot be tested in sandbox.** Paymob's sandbox does not support kiosk transactions, so no kiosk test credentials exist and a kiosk payment cannot be completed end-to-end in Test mode. (Confirmed with Paymob, August 2026.) + +- Do **not** substitute a test card for kiosk and record the method as validated — that exercises the card rail, not the kiosk rail. +- If the merchant is enabling kiosk, tell them **before** they plan go-live, not after. Cards and wallets validate in sandbox as normal, but kiosk verification has to be arranged with their Paymob account manager or `support@paymob.com`. Don't let a merchant treat a green sandbox run as covering a method that sandbox never touched. + +This file also has no entries for BNPL, Apple Pay, Google Pay, or bank installments. Don't assume they behave like cards, and don't infer a sandbox path for them from the card/wallet sections above — confirm with `support@paymob.com` for the specific method the merchant is enabling. + ## Using them 1. Make sure the Integration ID used in the Intention request is the **Test** version of the relevant payment method (Cards or Wallets), and that the Secret Key used is also Test mode — mismatched modes cause a 404 on intention creation (see `intention-api.md`). From 4930fe64c10f9835b682e61b06635593671f2ad5 Mon Sep 17 00:00:00 2001 From: Mohamed Ragab Date: Thu, 13 Aug 2026 17:55:51 +0300 Subject: [PATCH 3/3] Record that BNPL has no sandbox test path either Paymob confirmed BNPL (Valu, Souhoola, Tabby, Tamara, Sympl, and the other providers) is untestable in sandbox, same as kiosk. Group both under one statement and note the consequence for Phase 3: its exit criteria of "flip to Live only after a full successful test run" is not achievable for these methods, so a passing sandbox suite must not be presented as clearing them. Apple Pay, Google Pay, and bank installments remain unconfirmed and are labelled as such rather than assumed either way. --- README.md | 2 +- commands/paymob-test-cards.md | 6 +++--- .../references/test-credentials.md | 13 +++++++++---- 3 files changed, 13 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 26c9e05..22b2915 100644 --- a/README.md +++ b/README.md @@ -137,7 +137,7 @@ Once the plugin is installed, these slash commands give direct access to the mos | Command | What it does | |---|---| -| `/paymob-test-cards [card\|wallet\|kiosk]` | Prints sandbox test cards, wallet numbers, and OTPs from `references/test-credentials.md`, optionally filtered to one method. Always notes the 30-day sandbox expiry and that decline/error simulation isn't officially documented. | +| `/paymob-test-cards [card\|wallet\|kiosk\|bnpl]` | Prints sandbox test cards, wallet numbers, and OTPs from `references/test-credentials.md`, optionally filtered to one method. Always notes the 30-day sandbox expiry and that decline/error simulation isn't officially documented. For kiosk and BNPL it reports that sandbox can't test them at all, rather than offering a card as a stand-in. | | `/paymob-explain-error ` | Looks up a Paymob error against the Troubleshooting table in `SKILL.md`, explains the cause, and — for code fixes — pulls the corrected snippet from the matching `references/code-*.md` file for your stack. Falls back to `references/live-resources.md` for anything not in the table instead of guessing. | | `/paymob-check-hmac [path]` | Statically audits your webhook HMAC verification against `references/hmac-verification.md`: SHA-512 (not SHA-256), exact field order, `body.obj` sourcing, no `obj.id`/`obj.order.id` mix-up, fail-closed behavior, and unique-constraint-backed idempotency. Never asks you to paste your HMAC secret or API key; only invoked manually, never automatically. | diff --git a/commands/paymob-test-cards.md b/commands/paymob-test-cards.md index 81c8563..6ccd132 100644 --- a/commands/paymob-test-cards.md +++ b/commands/paymob-test-cards.md @@ -1,6 +1,6 @@ --- description: Show Paymob sandbox test card and wallet credentials, optionally filtered by payment method. -argument-hint: "[card|wallet|kiosk]" +argument-hint: "[card|wallet|kiosk|bnpl]" allowed-tools: Read --- @@ -9,8 +9,8 @@ Read `${CLAUDE_PLUGIN_ROOT}/skills/paymob-integration/references/test-credential Argument handling for `$ARGUMENTS`: - `card` → show only the Mastercard and Visa test card sections. - `wallet` → show only the test mobile wallet section. -- `kiosk` → report what the file's **Methods with no sandbox test path** section says. Do not offer a workaround that section doesn't list, and do not substitute a test card so the method looks covered. -- Any other method the file has no section for (BNPL, Apple/Google Pay, bank installments) → say plainly that the file has no entry for it, then point the user to `references/live-resources.md` (the `llms.txt` doc index and developer docs) or `support@paymob.com`. **Do not invent numbers, and do not substitute a card number as a stand-in.** Do not assert how that method's sandbox flow works either — if it isn't in the reference file, it isn't established here. +- `kiosk`, `bnpl`, or a named BNPL provider (Valu, Souhoola, Tabby, Tamara, Sympl, …) → report what the file's **Methods with no sandbox test path** section says. Do not offer a workaround that section doesn't list, and do not substitute a test card so the method looks covered. +- Any other method the file has no section for (Apple/Google Pay, bank installments) → say plainly that the file has no entry for it, then point the user to `references/live-resources.md` (the `llms.txt` doc index and developer docs) or `support@paymob.com`. **Do not invent numbers, and do not substitute a card number as a stand-in.** Do not assert how that method's sandbox flow works either — if it isn't in the reference file, it isn't established here. - No argument → show all sections the file contains (cards and wallet). Always carry over, verbatim in meaning, these two caveats from the source file regardless of which filter was used: diff --git a/skills/paymob-integration/references/test-credentials.md b/skills/paymob-integration/references/test-credentials.md index 244ed56..b547f6e 100644 --- a/skills/paymob-integration/references/test-credentials.md +++ b/skills/paymob-integration/references/test-credentials.md @@ -38,12 +38,17 @@ Use these **only** with Test-mode keys and Test-mode Integration IDs. Never use ## Methods with no sandbox test path -⚠️ **Kiosk (Aman, Masary) cannot be tested in sandbox.** Paymob's sandbox does not support kiosk transactions, so no kiosk test credentials exist and a kiosk payment cannot be completed end-to-end in Test mode. (Confirmed with Paymob, August 2026.) +⚠️ **These methods cannot be tested in sandbox at all.** No test credentials exist for them, and a payment cannot be completed end-to-end in Test mode. (Confirmed with Paymob, August 2026.) -- Do **not** substitute a test card for kiosk and record the method as validated — that exercises the card rail, not the kiosk rail. -- If the merchant is enabling kiosk, tell them **before** they plan go-live, not after. Cards and wallets validate in sandbox as normal, but kiosk verification has to be arranged with their Paymob account manager or `support@paymob.com`. Don't let a merchant treat a green sandbox run as covering a method that sandbox never touched. +- **Kiosk** — Aman, Masary +- **BNPL** — Valu, Souhoola, Tabby, Tamara, Sympl, and the other providers -This file also has no entries for BNPL, Apple Pay, Google Pay, or bank installments. Don't assume they behave like cards, and don't infer a sandbox path for them from the card/wallet sections above — confirm with `support@paymob.com` for the specific method the merchant is enabling. +What that means in practice: + +- Do **not** substitute a test card for one of these methods and record it as validated — that exercises the card rail, not theirs. +- **A green sandbox run does not cover them.** If the merchant is enabling kiosk or BNPL, tell them *before* they plan go-live, not after: cards and wallets validate in sandbox as normal, but these have to be verified with their Paymob account manager or `support@paymob.com`. The Phase 3 exit criteria in `SKILL.md` ("only flip to Live after a full successful test run") is not achievable for these methods, so don't present a passing sandbox suite as clearing them. + +**Not confirmed either way — don't assume:** Apple Pay, Google Pay, and bank installments. (`README.md` notes bank installments are "Live IDs only," which points the same way, but confirm with `support@paymob.com` before telling a merchant whether they can test it.) Don't infer a sandbox path for any of these from the card/wallet sections above. ## Using them